Extracted

• • Target

    Xworm 5.6.rar

  • Size

    55.0MB

  • MD5

    3014877fb9671676a0f960b8a37d672a

  • SHA1

    42f11dd3ca906a82fbaa7faf13a559ad8903afac

  • SHA256

    d7bdcf71e294f58cade0a1ad97d015d9ae40ee9a8eb0043acf993c8be7d120c1

  • SHA512

    d0411925e847131b6ec5590c204928f8be45786ce5bce09332ad2724b8f02ee9e87f8f7357726cd5d9174fbf0e8840cf608d8e677443ef467665e9f80414296c

  • SSDEEP

    1572864:KAVBljTM/E3il3pn23Lsc4gBy3WA8lUf4hzt+K+p0:KAt3M/G+3pn23Lbnk3WA6zsK+a

  Score

  10^/10

  xwormdiscoverypersistencerattrojan

  • Contains code to disable Windows Defender

    A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

  • Detect Xworm Payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Loads dropped DLL

  • Registers COM server for autorun

    persistence

  • Uses the VBS compiler for execution

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1